CVEブラウザに戻る

CVE-2004-0128

HIGH

7.5

CVSS Severity Score

EPSS Score0.0420%

EPSS Percentile28.83th

Published2004年3月3日

Last Modified2026年4月16日

Vulnerability Description

PHP remote file inclusion vulnerability in the GEDCOM configuration script for phpGedView 2.65.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script.

Affected Platforms (CPE)

📦

Phpgedview

Phpgedview

= 2.52.3

📦

Phpgedview

Phpgedview

= 2.60

📦

Phpgedview

Phpgedview

= 2.61

📦

Phpgedview

Phpgedview

= 2.61.1

📦

Phpgedview

Phpgedview

= 2.65

📦

Phpgedview

Phpgedview

= 2.65.1

References & Advisories

🔗 http://secunia.com/advisories/10753/

🔗 http://sourceforge.net/project/shownotes.php?release_id=141517

🔗 http://www.osvdb.org/3769

🔗 http://www.securityfocus.com/archive/1/352355

🔗 http://www.securityfocus.com/bid/9531

🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/14987

🔗 http://secunia.com/advisories/10753/

🔗 http://sourceforge.net/project/shownotes.php?release_id=141517

関連する脆弱性情報

CVE-2008-206410.0

Multiple unspecified vulnerabilities in PhpGedView before 4.1.5 have unknown impact and attack vectors related to "a fundamental d...

CVE-2004-00309.8

PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVI...

CVE-2004-00317.5

PHPGEDVIEW 2.61 allows remote attackers to reinstall the software and change the administrator password via a direct HTTP request ...

CVE-2004-00657.5

Multiple SQL injection vulnerabilities in phpGedView before 2.65 allow remote attackers to execute arbitrary SQL via (1) timeline....